<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
    "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="generator" content="AsciiDoc 8.2.5" />
<style type="text/css">
/* Debug borders */
p, li, dt, dd, div, pre, h1, h2, h3, h4, h5, h6 {
/*
  border: 1px solid red;
*/
}

body {
  margin: 1em 5% 1em 5%;
}

a {
  color: blue;
  text-decoration: underline;
}
a:visited {
  color: fuchsia;
}

em {
  font-style: italic;
}

strong {
  font-weight: bold;
}

tt {
  color: navy;
}

h1, h2, h3, h4, h5, h6 {
  color: #527bbd;
  font-family: sans-serif;
  margin-top: 1.2em;
  margin-bottom: 0.5em;
  line-height: 1.3;
}

h1, h2, h3 {
  border-bottom: 2px solid silver;
}
h2 {
  padding-top: 0.5em;
}
h3 {
  float: left;
}
h3 + * {
  clear: left;
}

div.sectionbody {
  font-family: serif;
  margin-left: 0;
}

hr {
  border: 1px solid silver;
}

p {
  margin-top: 0.5em;
  margin-bottom: 0.5em;
}

pre {
  padding: 0;
  margin: 0;
}

span#author {
  color: #527bbd;
  font-family: sans-serif;
  font-weight: bold;
  font-size: 1.1em;
}
span#email {
}
span#revision {
  font-family: sans-serif;
}

div#footer {
  font-family: sans-serif;
  font-size: small;
  border-top: 2px solid silver;
  padding-top: 0.5em;
  margin-top: 4.0em;
}
div#footer-text {
  float: left;
  padding-bottom: 0.5em;
}
div#footer-badges {
  float: right;
  padding-bottom: 0.5em;
}

div#preamble,
div.tableblock, div.imageblock, div.exampleblock, div.verseblock,
div.quoteblock, div.literalblock, div.listingblock, div.sidebarblock,
div.admonitionblock {
  margin-right: 10%;
  margin-top: 1.5em;
  margin-bottom: 1.5em;
}
div.admonitionblock {
  margin-top: 2.5em;
  margin-bottom: 2.5em;
}

div.content { /* Block element content. */
  padding: 0;
}

/* Block element titles. */
div.title, caption.title {
  font-family: sans-serif;
  font-weight: bold;
  text-align: left;
  margin-top: 1.0em;
  margin-bottom: 0.5em;
}
div.title + * {
  margin-top: 0;
}

td div.title:first-child {
  margin-top: 0.0em;
}
div.content div.title:first-child {
  margin-top: 0.0em;
}
div.content + div.title {
  margin-top: 0.0em;
}

div.sidebarblock > div.content {
  background: #ffffee;
  border: 1px solid silver;
  padding: 0.5em;
}

div.listingblock {
  margin-right: 0%;
}
div.listingblock > div.content {
  border: 1px solid silver;
  background: #f4f4f4;
  padding: 0.5em;
}

div.quoteblock > div.content {
  padding-left: 2.0em;
}

div.attribution {
  text-align: right;
}
div.verseblock + div.attribution {
  text-align: left;
}

div.admonitionblock .icon {
  vertical-align: top;
  font-size: 1.1em;
  font-weight: bold;
  text-decoration: underline;
  color: #527bbd;
  padding-right: 0.5em;
}
div.admonitionblock td.content {
  padding-left: 0.5em;
  border-left: 2px solid silver;
}

div.exampleblock > div.content {
  border-left: 2px solid silver;
  padding: 0.5em;
}

div.verseblock div.content {
  white-space: pre;
}

div.imageblock div.content { padding-left: 0; }
div.imageblock img { border: 1px solid silver; }
span.image img { border-style: none; }

dl {
  margin-top: 0.8em;
  margin-bottom: 0.8em;
}
dt {
  margin-top: 0.5em;
  margin-bottom: 0;
  font-style: italic;
}
dd > *:first-child {
  margin-top: 0;
}

ul, ol {
    list-style-position: outside;
}
div.olist2 ol {
  list-style-type: lower-alpha;
}

div.tableblock > table {
  border: 3px solid #527bbd;
}
thead {
  font-family: sans-serif;
  font-weight: bold;
}
tfoot {
  font-weight: bold;
}

div.hlist {
  margin-top: 0.8em;
  margin-bottom: 0.8em;
}
div.hlist td {
  padding-bottom: 5px;
}
td.hlist1 {
  vertical-align: top;
  font-style: italic;
  padding-right: 0.8em;
}
td.hlist2 {
  vertical-align: top;
}

@media print {
  div#footer-badges { display: none; }
}

div#toctitle {
  color: #527bbd;
  font-family: sans-serif;
  font-size: 1.1em;
  font-weight: bold;
  margin-top: 1.0em;
  margin-bottom: 0.1em;
}

div.toclevel1, div.toclevel2, div.toclevel3, div.toclevel4 {
  margin-top: 0;
  margin-bottom: 0;
}
div.toclevel2 {
  margin-left: 2em;
  font-size: 0.9em;
}
div.toclevel3 {
  margin-left: 4em;
  font-size: 0.9em;
}
div.toclevel4 {
  margin-left: 6em;
  font-size: 0.9em;
}
/* Workarounds for IE6's broken and incomplete CSS2. */

div.sidebar-content {
  background: #ffffee;
  border: 1px solid silver;
  padding: 0.5em;
}
div.sidebar-title, div.image-title {
  font-family: sans-serif;
  font-weight: bold;
  margin-top: 0.0em;
  margin-bottom: 0.5em;
}

div.listingblock div.content {
  border: 1px solid silver;
  background: #f4f4f4;
  padding: 0.5em;
}

div.quoteblock-content {
  padding-left: 2.0em;
}

div.exampleblock-content {
  border-left: 2px solid silver;
  padding-left: 0.5em;
}

/* IE6 sets dynamically generated links as visited. */
div#toc a:visited { color: blue; }
</style>
<script type="text/javascript">
/*<![CDATA[*/
window.onload = function(){generateToc(2)}
/* Author: Mihai Bazon, September 2002
 * http://students.infoiasi.ro/~mishoo
 *
 * Table Of Content generator
 * Version: 0.4
 *
 * Feel free to use this script under the terms of the GNU General Public
 * License, as long as you do not remove or alter this notice.
 */

 /* modified by Troy D. Hanson, September 2006. License: GPL */
 /* modified by Stuart Rackham, October 2006. License: GPL */

function getText(el) {
  var text = "";
  for (var i = el.firstChild; i != null; i = i.nextSibling) {
    if (i.nodeType == 3 /* Node.TEXT_NODE */) // IE doesn't speak constants.
      text += i.data;
    else if (i.firstChild != null)
      text += getText(i);
  }
  return text;
}

function TocEntry(el, text, toclevel) {
  this.element = el;
  this.text = text;
  this.toclevel = toclevel;
}

function tocEntries(el, toclevels) {
  var result = new Array;
  var re = new RegExp('[hH]([2-'+(toclevels+1)+'])');
  // Function that scans the DOM tree for header elements (the DOM2
  // nodeIterator API would be a better technique but not supported by all
  // browsers).
  var iterate = function (el) {
    for (var i = el.firstChild; i != null; i = i.nextSibling) {
      if (i.nodeType == 1 /* Node.ELEMENT_NODE */) {
        var mo = re.exec(i.tagName)
        if (mo)
          result[result.length] = new TocEntry(i, getText(i), mo[1]-1);
        iterate(i);
      }
    }
  }
  iterate(el);
  return result;
}

// This function does the work. toclevels = 1..4.
function generateToc(toclevels) {
  var toc = document.getElementById("toc");
  var entries = tocEntries(document.getElementsByTagName("body")[0], toclevels);
  for (var i = 0; i < entries.length; ++i) {
    var entry = entries[i];
    if (entry.element.id == "")
      entry.element.id = "toc" + i;
    var a = document.createElement("a");
    a.href = "#" + entry.element.id;
    a.appendChild(document.createTextNode(entry.text));
    var div = document.createElement("div");
    div.appendChild(a);
    div.className = "toclevel" + entry.toclevel;
    toc.appendChild(div);
  }
}
/*]]>*/
</script>
<title>Kerberos NFS and Zumastor</title>
</head>
<body>
<div id="header">
<h1>Kerberos NFS and Zumastor</h1>
<div id="toc">
  <div id="toctitle">Table of Contents</div>
  <noscript><p><b>JavaScript must be enabled in your browser to display the table of contents.</b></p></noscript>
</div>
</div>
<div id="preamble">
<div class="sectionbody">
<div class="para"><p>This is a quick guide to configuring and installing Kerberos with Zumastor
on a Debian or Ubuntu system.</p></div>
</div>
</div>
<h2 id="_setting_up_kerberos_nfs_with_zumastor">1. Setting up Kerberos NFS with Zumastor</h2>
<div class="sectionbody">
<div class="olist"><ol>
<li>
<p>
Configure Kerberos.  (See the instructions below.)
Skip this step if you already have Kerberos configured and working.
</p>
</li>
<li>
<p>
Add NFS client and server principals to Kerberos as follows
(where the client hostname is <em>client.domain</em> and the server hostname is
<em>server.domain</em>):
</p>
<div class="listingblock">
<div class="content">
<pre><tt># kadmin
kadmin: addprinc -randkey nfs/client.domain
kadmin: ktadd -e des-cbc-crc:normal -k /tmp/client-keytab nfs/client.domain
kadmin: addprinc -randkey nfs/server.domain
kadmin: ktadd -e des-cbc-crc:normal -k /tmp/server-keytab nfs/server.domain
kadmin: quit</tt></pre>
</div></div>
</li>
<li>
<p>
On the client system copy <tt>/tmp/client-keytab</tt> to <tt>/etc/krb5.keytab</tt>.
On the server copy <tt>/tmp/server-keytab</tt> to <tt>/etc/krb5.keytab</tt>.
</p>
</li>
<li>
<p>
Add the following lines to the <tt>/etc/exports</tt> file (where, again,
<em>testvol</em> is the Zumastor volume to be exported):
</p>
<div class="listingblock">
<div class="content">
<pre><tt>/var/run/zumastor/mount/testvol gss/krb5(rw,fsid=0,insecure,nohide,no_subtree_check,crossmnt)
/var/run/zumastor/mount/testvol *(ro,insecure,nohide,no_subtree_check,crossmnt)</tt></pre>
</div></div>
</li>
<li>
<p>
Add &#8220;NEED_SVCGSSD=yes&#8221; to the <tt>/etc/default/nfs-kernel-server</tt> script on
the server and restart NFS:
</p>
<div class="listingblock">
<div class="content">
<pre><tt>/etc/init.d/nfs-kernel-server restart</tt></pre>
</div></div>
</li>
<li>
<p>
Verify that <tt>rpc.svcgssd</tt>, <tt>portmap</tt> and <tt>rpc.mountd</tt> are running on the NFS
server and <tt>rpc.gssd</tt> is running on the NFS client.  Now you may mount the
Kerberos-protected NFS file system on the client:
</p>
<div class="listingblock">
<div class="content">
<pre><tt>mount -tnfs -o "sec=krb5" server.domain:/var/run/zumastor/mount/testvol /home</tt></pre>
</div></div>
</li>
</ol></div>
</div>
<h2 id="_installing_and_configuring_kerberos">2. Installing and Configuring Kerberos</h2>
<div class="sectionbody">
<div class="olist"><ol>
<li>
<p>
Install the Kerberos packages (<tt>krb5-admin-server</tt> and <tt>krb5-kdc</tt>):
</p>
<div class="listingblock">
<div class="content">
<pre><tt># apt-get install krb5-admin-server krb5-kdc</tt></pre>
</div></div>
</li>
<li>
<p>
Add the following lines to <tt>/etc/krb5.conf</tt>:
</p>
<div class="listingblock">
<div class="content">
<pre><tt>[libdefaults]
default_realm = TEST.DEBIAN.ORG
forwardable = true
[domain_realm]
[realms]
TEST.DEBIAN.ORG = {
admin_server = kdc.debian.org
kdc = kdc.debian.org
}</tt></pre>
</div></div>
</li>
<li>
<p>
Create the Kerberos realm:
</p>
<div class="listingblock">
<div class="content">
<pre><tt># kdb5_util create -s -r TEST.DEBIAN.ORG</tt></pre>
</div></div>
</li>
<li>
<p>
Create an ACL file for kdc:
</p>
<div class="listingblock">
<div class="content">
<pre><tt># echo "*/admin *" &gt; /etc/krb5kdc/kadm5.acl</tt></pre>
</div></div>
</li>
<li>
<p>
Start kdc and kadmind:
</p>
<div class="listingblock">
<div class="content">
<pre><tt>/usr/sbin/krb5kdc
/usr/sbin/kadmind</tt></pre>
</div></div>
</li>
<li>
<p>
Create an initial principal using <tt>kadmin.local</tt>:
</p>
<div class="listingblock">
<div class="content">
<pre><tt># kadmin.local
kadmin.local: addprinc root/admin@TEST.DEBIAN.ORG
kadmin.local: quit</tt></pre>
</div></div>
</li>
</ol></div>
</div>
<div id="footer">
<div id="footer-text">
Last updated 2007-12-10 16:00:38 PDT
</div>
</div>
</body>
</html>
